ci(docker): publish image to Gitea registry (dev + main), mirror AegisGitea-MCP

Replace the opt-in docker workflow with the AegisGitea-MCP-style pipeline:
lint -> test -> build -> smoke-test -> push to git.hiddenden.cafe.

- Image git.hiddenden.cafe/hiddenden/familiar; main -> :latest + :main, dev ->
  :dev, every build also tagged :sha-<12>. Push gated to main/dev push events,
  authenticated with the REGISTRY_TOKEN secret; scoped cleanup after each run.
- docker-compose.yml pulls the published image (FAMILIAR_IMAGE, default :latest)
  with local build as a fallback; .env.example + docs/deployment.md document the
  channels and the pull-based deploy.

.env.example

@@ -28,6 +28,10 @@ FAMILIAR_DATA_DIR_HOST=./data
 # Writes off by default on a public instance. Set true to allow guarded writes.
 FAMILIAR_ENABLE_WRITES=false
 
+# --- Image (published to Gitea by .gitea/workflows/docker.yml) -------------- #
+# Prod channel: :latest or :main. Dev channel: :dev. Or pin a :sha-xxxxxxxx tag.
+FAMILIAR_IMAGE=git.hiddenden.cafe/hiddenden/familiar:latest
+
 # --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
 FAMILIAR_DOMAIN=familiar.example.com
 TRAEFIK_CERTRESOLVER=letsencrypt